Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label cybersecurity threat actors. Show all posts
LLMs
AI Tool Cyber Security cybersecurity threat actors Firewalls Fortinet LLMs

Researchers Link AI Tool CyberStrikeAI to Attacks on Hundreds of Fortinet Firewalls

 



Cybersecurity researchers have identified an artificial intelligence–based security testing framework known as CyberStrikeAI being used within infrastructure associated with a hacking campaign that recently compromised hundreds of enterprise firewall systems.

The warning follows an earlier report describing an AI-assisted intrusion operation that infiltrated more than 500 devices running Fortinet FortiGate within roughly five weeks. Investigators observed that the attacker relied on several servers to conduct the activity, including one hosted at the IP address 212.11.64[.]250.

A new analysis from the threat intelligence organization Team Cymru indicates that the same server was running the CyberStrikeAI platform. According to senior threat intelligence advisor Will Thomas, also known online as BushidoToken, network monitoring revealed that the address was hosting the AI security framework.

By reviewing NetFlow traffic records, researchers detected a service banner identifying CyberStrikeAI operating on port 8080 of the server. The same monitoring data also revealed communications between the system and Fortinet FortiGate devices that were targeted in the attack campaign. Evidence shows that the infrastructure used in the firewall exploitation activity was still running CyberStrikeAI as recently as January 30, 2026.

CyberStrikeAI’s public repository describes the project as an AI-native penetration testing platform written in the Go programming language. The framework integrates more than 100 existing security tools, along with a coordination engine that can manage tasks, assign predefined roles, and apply a modular skills system to automate testing workflows.

Project documentation explains that the platform employs AI agents and the MCP protocol to convert conversational instructions into automated security operations. Through this system, users can perform tasks such as vulnerability discovery, analysis of multi-step attack chains, retrieval of technical knowledge, and visualization of results in a structured testing environment.

The platform also contains an AI decision-making engine compatible with major large language models including GPT, Claude, and DeepSeek. Its interface includes a password-protected web dashboard, logging features that track activity for auditing purposes, and a SQLite database used to store results. Additional modules provide tools for vulnerability tracking, orchestrating attack tasks, and mapping complex attack chains.

CyberStrikeAI integrates a broad set of widely used offensive security tools capable of covering an entire intrusion workflow. These include reconnaissance utilities such as nmap and masscan, web application testing tools like sqlmap, nikto, and gobuster, exploitation frameworks including metasploit and pwntools, password-cracking programs such as hashcat and john, and post-exploitation utilities like mimikatz, bloodhound, and impacket.

When these tools are combined with AI-driven automation and orchestration, the system allows operators to conduct complex cyberattacks with drastically less technical expertise. Researchers warn that this type of AI-assisted automation could accelerate the discovery and targeting of internet-facing infrastructure, particularly devices located at the network edge such as firewalls and VPN appliances.

Team Cymru reported identifying 21 different IP addresses running CyberStrikeAI between January 20 and February 26, 2026. The majority of these servers were located in China, Singapore, and Hong Kong, although additional instances were detected in the United States, Japan, and several European countries.

Thomas noted that as cyber adversaries increasingly adopt AI-driven orchestration platforms, security teams should expect automated campaigns targeting vulnerable edge devices to become more common. The reconnaissance and exploitation activity directed at Fortinet FortiGate systems may represent an early example of this emerging trend.

Researchers also examined the online identity of the individual believed to be behind CyberStrikeAI, who uses the alias “Ed1s0nZ.” Public repositories linked to the account reference several additional AI-based offensive security tools. Among them are PrivHunterAI, which focuses on identifying privilege-escalation weaknesses using AI models, and InfiltrateX, a tool designed to scan systems for potential privilege escalation pathways.

According to Team Cymru, the developer’s GitHub activity shows interactions with organizations previously associated with cyber operations linked to China.

In December 2025, the developer shared the CyberStrikeAI project with Knownsec’s 404 “Starlink Project.” Knownsec is a Chinese cybersecurity firm that has been reported by analysts to have connections to government-linked cyber initiatives.

The developer’s GitHub profile also briefly referenced receiving a “CNNVD 2024 Vulnerability Reward Program – Level 2 Contribution Award” on January 5, 2026. The China National Vulnerability Database (CNNVD) has been widely reported by security researchers to operate within China’s intelligence ecosystem and to track vulnerabilities that may later be used in cyber operations. Investigators noted that the reference to this award was later removed from the profile.

At the same time, analysts emphasize that the developer’s repositories are primarily written in Chinese, and interaction with domestic cybersecurity groups does not automatically indicate involvement in state-linked activities.

The rise in AI-assisted offensive security tools demonstrates how threat actors are increasingly using artificial intelligence to streamline cyber operations. By automating reconnaissance, vulnerability detection, and exploitation steps, such platforms significantly reduce the expertise required to launch sophisticated attacks.

This trend is already being observed across the broader threat network. Recent research from Google reported that attackers have begun incorporating the Gemini AI platform into several phases of cyberattacks, further illustrating how generative AI technologies are reshaping both defensive and offensive cybersecurity practices.

Read more »
GuidePoint Security
Akira Ransomware Cyber Crime Cyber Security Ransomware Attacks cybercrime group cybercrime group attack cybersecurity threat actors GuidePoint Security

Global Ransomware Groups Hit Record High as Smaller Threat Actors Emerge

 

The number of active ransomware groups has reached an unprecedented high, marking a new phase in the global cyber threat landscape. According to GuidePoint Security’s latest Ransomware & Cyber Threat Report, the total number of active groups surged 57%, climbing from 49 in the third quarter of 2024 to an all-time peak of 77. Despite this sharp rise, the number of victims has remained consistent, averaging between 1,500 and 1,600 per quarter since late last year. 

The United States continues to bear the brunt of these attacks, accounting for 56% of all reported victims. Germany and the United Kingdom followed distantly at 5% and 4%, respectively. Manufacturing, technology, and the legal sectors were among the hardest hit, with the manufacturing industry alone reporting 252 publicly claimed attacks in the second quarter—a 26% increase from the previous quarter. 

GuidePoint’s senior threat intelligence analyst, Nick Hyatt, noted that while the overall ransomware volume has stabilized, the number of distinct groups is soaring. He explained that this growth reflects both the consolidation of experienced threat actors under major ransomware-as-a-service (RaaS) platforms and the influx of newer, less skilled operators trying to gain traction in the ecosystem. 

Among the most active groups, Qilin led with a dramatic 318% year-over-year surge, claiming 234 victims this quarter. Akira followed with 130 victims, while IncRansom—first detected in August 2023—emerged as the third most active group after a sharp increase in attacks. Another rising player, SafePay, has steadily expanded its operations since its appearance in late 2024, now linked to 258 victims across 29 industries and 30 countries in 2025 alone. 

GuidePoint’s researchers also observed a growing number of unclaimed or unattributed ransomware attacks, suggesting that many threat actors are either newly formed or deliberately avoiding public identification. This trend points to an increasingly fragmented and unpredictable ransomware environment. 

While the stabilization in overall attack numbers might appear reassuring, experts warn against complacency. The rapid diversification of ransomware groups and the proliferation of smaller, anonymous actors underline the evolving sophistication of cybercrime. As Hyatt emphasized, this “new normal” reflects a sustained, adaptive threat landscape that demands continuous vigilance, proactive defense strategies, and cross-industry collaboration to mitigate future risks.
Read more »
UNK_GreenSec threat group
cybersecurity threat actors malware Morpheus ransomware RomCom RAT TA829 cyberattacks TransferLoader UNK_GreenSec threat group

RomCom RAT and TransferLoader Attacks Reveal Alarming Parallels in Cyber Espionage and Ransomware Tactics

 

Cybersecurity experts have uncovered strategic overlaps between two advanced threat groups: the operators of the RomCom RAT and another entity linked to a malware loader known as TransferLoader.

According to enterprise security firm Proofpoint, the TransferLoader activity is being tracked under the alias UNK_GreenSec, while RomCom RAT operations are attributed to the group TA829—also identified in cybersecurity circles as CIGAR, Storm-0978, Nebulous Mantis, and Void Rabisu, among other names.

Proofpoint's investigation into TA829 led to the discovery of UNK_GreenSec, with both groups displaying a high degree of similarity in infrastructure setup, email lure themes, delivery methods, and landing pages. “An unusual amount of similar infrastructure, delivery tactics, landing pages, and email lure themes,” the company reported.

TA829 stands out in the cyber threat ecosystem for conducting both intelligence-gathering missions and financially driven cyberattacks. Believed to be aligned with Russian interests, the group has exploited zero-day vulnerabilities in Mozilla Firefox and Microsoft Windows to spread RomCom RAT to global victims.

Earlier this year, PRODAFT revealed that the threat actors behind RomCom RAT used stealthy techniques such as bulletproof hosting, encrypted C2 communication, and living-off-the-land (LOTL) tactics to avoid detection.

TransferLoader, meanwhile, was first analyzed by Zscaler’s ThreatLabz following a February 2025 campaign in which it was deployed to distribute Morpheus ransomware to an unnamed American law firm.

Proofpoint also noted that both TA829 and UNK_GreenSec use REM Proxy services hosted on compromised MikroTik routers as part of their upstream communication channels. However, the method of compromising these routers remains unknown.

"REM Proxy devices are likely rented to users to relay traffic," said the Proofpoint threat research team. "In observed campaigns, both TA829 and UNK_GreenSec use the service to relay traffic to new accounts at freemail providers to then send to targets."

Further analysis suggests that both actors may rely on an automated email builder to rapidly generate sender accounts, as evidenced by similarly formatted addresses such as ximajazehox333@gmail.com and hannahsilva1978@ukr.net.

The phishing messages commonly carry a malicious link, embedded either directly in the email body or inside a PDF attachment. Victims clicking on these links are redirected through services like Rebrandly, ultimately landing on spoofed Google Drive or Microsoft OneDrive pages—carefully filtering out sandbox environments or uninteresting systems.

From here, the infection chain splits: victims redirected by UNK_GreenSec receive TransferLoader, while those targeted by TA829 are delivered a separate strain dubbed SlipScreen.

Both groups have reportedly used PuTTY’s PLINK utility to establish SSH tunnels and hosted payloads on IPFS (InterPlanetary File System) for further stages of their campaigns.

SlipScreen serves as a stealthy loader that decrypts and injects shellcode directly into system memory, but only proceeds if it detects at least 55 recently accessed documents in the Windows Registry—an apparent method to evade sandbox detection.

"We assess that 55 is an arbitrary number chosen by the actor," said Greg Lesnewich, senior threat researcher at Proofpoint. "Previous versions checked for 100 documents. It’s unclear why this threshold changed."

The loader then drops malware such as MeltingClaw (aka DAMASCENED PEACOCK) or RustyClaw, which can install backdoors like ShadyHammock or DustyHammock. ShadyHammock is often used to deploy SingleCamper (also known as SnipBot), an evolved version of RomCom RAT. DustyHammock, in addition to system reconnaissance, can retrieve payloads from IPFS-based storage.

TransferLoader-linked campaigns have been seen using job application-themed lures, tricking victims into clicking on a fake resume link that initiates the download of TransferLoader from an IPFS-hosted webshare.

Designed for stealth, TransferLoader enables the silent deployment of additional malicious tools including Metasploit and Morpheus ransomware, a rebranded variant of HellCat ransomware.
Read more »
Subscribe to: Comments (Atom)